PT-2020-1539 · Oracle · Oracle Database Server+1

Harrison Neal · Published 2020-01-14 · Updated 2022-10-25 · CVE-2020-2515

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c

Description The issue is related to a vulnerability in the Database Gateway for ODBC component, which can be exploited by a low-privileged attacker with Create Session privilege and network access via OracleNet. This can lead to unauthorized update, insert, or delete access to some Database Gateway for ODBC accessible data, as well as unauthorized read access to a subset of Database Gateway for ODBC accessible data. Additionally, it can cause a partial denial of service (partial DOS) of Database Gateway for ODBC. The vulnerability is difficult to exploit.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting network access via OracleNet to minimize the risk of exploitation. As a temporary workaround, consider disabling the Create Session privilege for low-privileged attackers until a patch is available. Restrict access to the Database Gateway for ODBC component to minimize the risk of unauthorized data access and denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00532

CVE-2020-2515

Affected Products

Oracle Database

Oracle Database Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-2515 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00532 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2515 · Vendor Advisory
• https://support.oracle.com/rs?type=doc&id=2602410.1 · Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note